CVE-2015-3225

rubygem-rack: Potential Denial of Service Vulnerability in Rack normalize_params()

Published Jul 26, 2015 CVSS 2.0 · 5.0 Medium EPSS 7.9% KEV · Not listed
Description
lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to cause a denial of service (SystemStackError) via a request with a large parameter depth.

Remediation

No solution or workaround provided in the CVE record

Tracking

Sign in to view the affected projects.

Advisories

Source ID Title
Debian DLA Debian DLA DLA-254-1 librack-ruby security update
Debian DSA Debian DSA DSA-3322-1 ruby-rack security update
Github GHSA Github GHSA GHSA-rgr4-9jh5-j4j6 Rack vulnerable to Denial of Service via large parameter depth request
History

No history.

Weaknesses

Sources

Status
PUBLISHED
Assigner
redhat
Published
Updated
Aug 6, 2024, 5:39 AM
Reserved
Apr 10, 2015, 12:00 AM
Status
Modified
Published
Jul 26, 2015, 10:59 PM
Modified
Jun 17, 2026, 12:25 AM
Severity
Moderate
Public date
Jun 16, 2015, 12:00 AM